DNS over HTTPS (DoH)
DNS over HTTPS (DoH) is a way to send DNS queries encrypted inside HTTPS so that other nodes on the network cannot read them.
Updated · Prokso editorial team
Before opening a website, a program asks DNS which IP address stands behind the domain. A normal DNS query travels as plain text, so your ISP and any node on the way can see it. DNS over HTTPS wraps that query in an HTTPS connection to a DNS server, and from the outside it looks like ordinary web traffic.
There is a similar method called DNS over TLS (DoT). It also encrypts queries, but it uses a separate port 853, so it is easier to spot and filter on a network. DoH works over port 443, like most websites.
DoH is linked to proxies through the DNS leak. That is when pages go through the proxy, but name lookups go directly through your ISP. The DNS server then sees which websites you open and from which network.
Where the name is resolved depends on the proxy type. For HTTPS over HTTP CONNECT, the client passes the host name to the proxy, and the proxy looks up the address. SOCKS5 has two options: the client can find the IP itself and pass it on, or pass the name so the proxy resolves it. In curl this is the difference between socks5:// and socks5h://: with the letter h, the proxy resolves the name.
This difference has practical meaning. If your computer resolves the name, the DNS query comes from your network, and the program may get a server address picked for your region. If the proxy resolves the name, DNS sees the proxy network, and the server address is picked for the exit country. When you work through a proxy, the second option is usually more logical, because all connection data then comes from one place. Your ISP also does not see which domains you open.
In browsers, DoH is turned on in the security settings, usually under a name like "Secure DNS" or "Use secure DNS". Keep in mind that when a proxy is set, a browser may handle DoH differently depending on its version and settings. So after any change, check the result instead of relying on the name of the option.
A simple order of steps looks like this. Set up the proxy, for SOCKS5 choose the mode in which the proxy resolves names, then open any DNS leak test service. Command examples for different protocols are in the curl guide.
FAQ
Does DoH prevent DNS leaks when I use a proxy?
It encrypts queries, but they may still go around the proxy. It is more reliable to let the proxy resolve names: with HTTP CONNECT this happens automatically, with SOCKS5 you need the right client mode, such as socks5h in curl.
How is DoH different from DoT?
Both encrypt DNS queries. DoH runs over HTTPS on port 443 and looks like ordinary web traffic, while DoT uses a separate port 853.
Residential $1.59, mobile $2.50, datacenter $0.65 per GB
Sign up in a minute, get access right after payment.